xref: /openbmc/linux/security/Kconfig (revision 827634ad)
1#
2# Security configuration
3#
4
5menu "Security options"
6
7source security/keys/Kconfig
8
9config SECURITY_DMESG_RESTRICT
10	bool "Restrict unprivileged access to the kernel syslog"
11	default n
12	help
13	  This enforces restrictions on unprivileged users reading the kernel
14	  syslog via dmesg(8).
15
16	  If this option is not selected, no restrictions will be enforced
17	  unless the dmesg_restrict sysctl is explicitly set to (1).
18
19	  If you are unsure how to answer this question, answer N.
20
21config SECURITY
22	bool "Enable different security models"
23	depends on SYSFS
24	depends on MULTIUSER
25	help
26	  This allows you to choose different security modules to be
27	  configured into your kernel.
28
29	  If this option is not selected, the default Linux security
30	  model will be used.
31
32	  If you are unsure how to answer this question, answer N.
33
34config SECURITYFS
35	bool "Enable the securityfs filesystem"
36	help
37	  This will build the securityfs filesystem.  It is currently used by
38	  the TPM bios character driver and IMA, an integrity provider.  It is
39	  not used by SELinux or SMACK.
40
41	  If you are unsure how to answer this question, answer N.
42
43config SECURITY_NETWORK
44	bool "Socket and Networking Security Hooks"
45	depends on SECURITY
46	help
47	  This enables the socket and networking security hooks.
48	  If enabled, a security module can use these hooks to
49	  implement socket and networking access controls.
50	  If you are unsure how to answer this question, answer N.
51
52config SECURITY_NETWORK_XFRM
53	bool "XFRM (IPSec) Networking Security Hooks"
54	depends on XFRM && SECURITY_NETWORK
55	help
56	  This enables the XFRM (IPSec) networking security hooks.
57	  If enabled, a security module can use these hooks to
58	  implement per-packet access controls based on labels
59	  derived from IPSec policy.  Non-IPSec communications are
60	  designated as unlabelled, and only sockets authorized
61	  to communicate unlabelled data can send without using
62	  IPSec.
63	  If you are unsure how to answer this question, answer N.
64
65config SECURITY_PATH
66	bool "Security hooks for pathname based access control"
67	depends on SECURITY
68	help
69	  This enables the security hooks for pathname based access control.
70	  If enabled, a security module can use these hooks to
71	  implement pathname based access controls.
72	  If you are unsure how to answer this question, answer N.
73
74config INTEL_TXT
75	bool "Enable Intel(R) Trusted Execution Technology (Intel(R) TXT)"
76	depends on HAVE_INTEL_TXT
77	help
78	  This option enables support for booting the kernel with the
79	  Trusted Boot (tboot) module. This will utilize
80	  Intel(R) Trusted Execution Technology to perform a measured launch
81	  of the kernel. If the system does not support Intel(R) TXT, this
82	  will have no effect.
83
84	  Intel TXT will provide higher assurance of system configuration and
85	  initial state as well as data reset protection.  This is used to
86	  create a robust initial kernel measurement and verification, which
87	  helps to ensure that kernel security mechanisms are functioning
88	  correctly. This level of protection requires a root of trust outside
89	  of the kernel itself.
90
91	  Intel TXT also helps solve real end user concerns about having
92	  confidence that their hardware is running the VMM or kernel that
93	  it was configured with, especially since they may be responsible for
94	  providing such assurances to VMs and services running on it.
95
96	  See <http://www.intel.com/technology/security/> for more information
97	  about Intel(R) TXT.
98	  See <http://tboot.sourceforge.net> for more information about tboot.
99	  See Documentation/intel_txt.txt for a description of how to enable
100	  Intel TXT support in a kernel boot.
101
102	  If you are unsure as to whether this is required, answer N.
103
104config LSM_MMAP_MIN_ADDR
105	int "Low address space for LSM to protect from user allocation"
106	depends on SECURITY && SECURITY_SELINUX
107	default 32768 if ARM || (ARM64 && COMPAT)
108	default 65536
109	help
110	  This is the portion of low virtual memory which should be protected
111	  from userspace allocation.  Keeping a user from writing to low pages
112	  can help reduce the impact of kernel NULL pointer bugs.
113
114	  For most ia64, ppc64 and x86 users with lots of address space
115	  a value of 65536 is reasonable and should cause no problems.
116	  On arm and other archs it should not be higher than 32768.
117	  Programs which use vm86 functionality or have some need to map
118	  this low address space will need the permission specific to the
119	  systems running LSM.
120
121source security/selinux/Kconfig
122source security/smack/Kconfig
123source security/tomoyo/Kconfig
124source security/apparmor/Kconfig
125source security/yama/Kconfig
126
127source security/integrity/Kconfig
128
129choice
130	prompt "Default security module"
131	default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
132	default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
133	default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
134	default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
135	default DEFAULT_SECURITY_YAMA if SECURITY_YAMA
136	default DEFAULT_SECURITY_DAC
137
138	help
139	  Select the security module that will be used by default if the
140	  kernel parameter security= is not specified.
141
142	config DEFAULT_SECURITY_SELINUX
143		bool "SELinux" if SECURITY_SELINUX=y
144
145	config DEFAULT_SECURITY_SMACK
146		bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
147
148	config DEFAULT_SECURITY_TOMOYO
149		bool "TOMOYO" if SECURITY_TOMOYO=y
150
151	config DEFAULT_SECURITY_APPARMOR
152		bool "AppArmor" if SECURITY_APPARMOR=y
153
154	config DEFAULT_SECURITY_YAMA
155		bool "Yama" if SECURITY_YAMA=y
156
157	config DEFAULT_SECURITY_DAC
158		bool "Unix Discretionary Access Controls"
159
160endchoice
161
162config DEFAULT_SECURITY
163	string
164	default "selinux" if DEFAULT_SECURITY_SELINUX
165	default "smack" if DEFAULT_SECURITY_SMACK
166	default "tomoyo" if DEFAULT_SECURITY_TOMOYO
167	default "apparmor" if DEFAULT_SECURITY_APPARMOR
168	default "yama" if DEFAULT_SECURITY_YAMA
169	default "" if DEFAULT_SECURITY_DAC
170
171endmenu
172
173